Is CVE-2026-63753 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-63753?

CVE-2026-63753 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-63753

Description

SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes.